APA: Estep, Samuel (2018) "Elliptic Curves" The Kabod 4( 2 (2018)), Article 1. Retrieved from vol4/iss2/1

Transcription

1 The Kabod Volume 4 Issue 2 Spring 2018 Article 1 February 2018 Elliptic Curves Samuel Estep Liberty University, sestep@liberty.edu Follow this and additional works at: Part of the Communication Commons Recommended Citations MLA: Estep, Samuel "Elliptic Curves," The Kabod 4. 2 (2018) Article 1. Liberty University Digital Commons. Web. [xx Month xxxx]. APA: Estep, Samuel (2018) "Elliptic Curves" The Kabod 4( 2 (2018)), Article 1. Retrieved from vol4/iss2/1 Turabian: Estep, Samuel "Elliptic Curves" The Kabod 4, no (2018) Accessed [Month x, xxxx]. Liberty University Digital Commons. This Individual Article is brought to you for free and open access by DigitalCommons@Liberty University. It has been accepted for inclusion in The Kabod by an authorized editor of DigitalCommons@Liberty University. For more information, please contact scholarlycommunication@liberty.edu.

2 Estep: Elliptic Curves Elliptic Curves Sam Estep November 26, Motivation Elliptic curves have found widespread use in number theory and applications thereof, such as cryptography. In this paper we will first examine the basic theory of elliptic curves and then look specifically at how they can be used to construct cryptographic systems more efficient than their counterparts, and how they can be used to generate proofs for or against primality. 1.1 Cryptography Cryptography is the most important current field of application for elliptic curves. In the most general terms, cryptography is the art of making it easy for parties to communicate with each other while simultaneously making it difficult for attackers to compromise this communication. For a given cryptographic system, we can usually increase or decrease the key size to get more or less security, respectively. This change in key size will affect the time, memory, and power requirements of the system. In other words, these two requirements of ease for communicators and difficulty for attackers are inversely related in the context of a given system. The question then becomes, what is the ratio in this relation for different systems? As it turns out, for a given level of security, elliptic curve cryptography works with keys an order of magnitude smaller than those required by other systems.? This reduced memory demand is accompanied by corresponding reductions in power and time demands. As a result, elliptic curve cryptography is slowly but surely becoming a staple in our everyday communication. 1 Published by DigitalCommons@Liberty University,

3 The Kabod, Vol. 4, Iss. 2 [2018], Art Primality Up until the 1970s, number theory in general and prime numbers in specific were regarded as demonstrations of the part of mathematics that has no practical import. Some number theorists, such as Hardy, found a certain amount of satisfaction in the idea that their work would not be used for military purposes.? The invention of RSA and the ever-increasing usage of computers have brought a swift end to this notion. In order to make use of the properties of prime numbers, we need to actually be working with prime numbers. In other words, given n Z +, we would like to have a method to determine whether or not n is prime. If n > 1 is composite then there exist some a, b Z + with 1 < a b < n such that ab = n. If a, b > n then ab > n n = n which is a contradiction, so since a b we know that a n. Thus the most naïve primality testing algorithm is to check all m Z + with 1 < m n; if m n for any such m then n is composite; otherwise n is prime. This algorithm has time complexity O( n), which is infeasibly slow when n has many digits. An algorithm was discovered in 2002 that can determine primality of n in time proportional to a polynomial in the number of digits of n.? The most efficient version of this algorithm runs in O(log 6 n) time, which is decent, but even using the most efficient primality checking algorithms known, checking the primality of a large number can still take an inconvenient amount of time. If, say, we have a number that we know to be prime, we would like to be able to communicate this knowledge to someone else in a way that they can verify it efficiently without having to trust us; this is the concept of a primality certificate. For p Z + prime, elliptic curves give us the most efficient known way to generate a certificate of size O(log 2 p) that takes O(log 4 p) time to check, which is considerably faster than starting from scratch.? 2 Group Theory 2.1 General Form Let F be a field. Given A, B F, an elliptic curve E over F is the graph of y 2 = x 3 + Ax + B for x, y F. For reasons discussed below, we also include a point at infinity O / F F in the elliptic curve. This point O can be thought of as the point at 2 2

4 Estep: Elliptic Curves which distinct vertical lines in the F F plane meet. It can be formalized using projective space, but we will not explore that here.? To summarize, E = {O} {(x, y) F F y 2 = x 3 + Ax + B}. It can be helpful to consider F = R and think of elliptic curves geometrically.? Trying different values of A and B demonstrates that we can cause the curve to have either two components, such as for or just one component, such as for (A, B) = ( 1, 0) y 2 = x 3 x, (A, B) = ( 1, 1) y 2 = x 3 x + 1. In general, we can show that the discriminant = 16(4a b 2 ) is positive if the graph has two components and negative if the graph has one component. We would like to avoid cusps, self-intersections, and isolated points, so we will say that if = 0 then E is not an elliptic curve. Algebraically, this means that the roots of 0 = x 3 + Ax + B are distinct, which follows even in F R where geometric intuition breaks down. 2.2 Group Law We will work toward an appropriate definition of + : E E E that makes E into an additive abelian group. A first guess might be the operation defined by F F. However, as an example, if F = Q and (A, B) = ( 1, 0) as in the example above, our equation is y 2 = x 3 x, so (1, 0) E, but (0 + 0) 2 = 0 6 = (1 + 1) 3 (1 + 1) (1 + 1, 0 + 0) / E. Thus E {O} may not be a subgroup of F F, so we need something else. We will develop the group law from a geometric standpoint motivated by the F = R case, but we will show each step algebraically for an arbitrary F, assuming the characteristic of F is not 2. It is possible to generalize to fields of characteristic 2, but we will ignore that case here.? Given P 1, P 2 E, draw a line through P 1 and P 2. We will see that this line also intersects E at a point P 3. Then reflect P 3 across the x-axis to obtain 3 Published by DigitalCommons@Liberty University,

5 The Kabod, Vol. 4, Iss. 2 [2018], Art. 1 P 3. We want to turn the somewhat vague geometric decree that P 1 +P 2 = P 3 into an algebraic formulation of our group law. If O, P 1, P 2 are all distinct then we can destructure them as P 1 = (x 1, y 1 ) and P 2 = (x 2, y 2 ). If x 1 x 2 then the nonvertical line through P 1 and P 2 is y = m(x x 1 ) + y 1 where m = (y 2 y 1 )(x 2 x 1 ) 1. Substituting this y into the elliptic curve equation yields 0 = x 3 + Ax + B (m(x x 1 ) + y 1 ) 2 = x 3 m 2 x 2 + αx + β. where α = A + 2m 2 x 1 2my 1 and β = B m 2 x mx 1 y 1 y 2 1. We know that x 1 is a solution to this equation and thus a factor of the polynomial, so the division algorithm yields 0 = x 3 m 2 x 2 + αx + β = (x x 1 )(x 2 + (x 1 m 2 )x + γ) where γ = x 1 (x 1 m 2 ) + α. We also know that x 2 is a solution and x 2 x 1, so applying the division algorithm a second time yields 0 = (x x 1 )(x 2 + (x 1 m 2 )x + γ) = (x x 1 )(x x 2 )(x (m 2 x 1 x 2 )). Thus if we let x 3 = m 2 x 1 x 2 and y 3 = m(x 3 x 1 ) + y 1 then we know P 1, P 2, and (x 3, y 3) are all the points of intersection of the line and the curve. We reflect across the x-axis to obtain y 3 = m(x 1 x 3 ) y 1, let P 3 = (x 3, y 3 ), and say P 1 + P 2 = P 3. If x 1 = x 2 then the line through P 1 and P 2 is vertical, so it intersects E at O. If you take the point at which vertical lines meet and reflect it across the x-axis, you still have the point at which vertical lines meet, so we say P 1 + P 2 = O. If O P 1 = P 2 then we can t take the secant line as above because x 2 x 1 = 0 is not invertible. However, differentiating the elliptic curve equation gives us 2y dy = 3x 2 dx + A dx dy dx = 3x2 + A, 2y suggesting that we can use this slope instead to obtain another point. We interpret y 1 = 0 as a vertical tangent line and say P 1 + P 2 = O as above, 4 4

6 Estep: Elliptic Curves so consider the case y 1 0 where we can define the nonvertical tangent line through P 1 = P 2 as y = m(x x 1 ) + y 1 where m = (3x A)(2y 1 ) 1 ; again, we assume that F is not characteristic 2. The same substitution as above, along with the knowledge that x 1 is a solution, yields 0 = x 3 + Ax + B (m(x x 1 ) + y 1 ) 2 = x 3 m 2 x 2 + αx + β = (x x 1 )(x 2 + (x 1 m 2 )x + γ) with α, β, γ defined the same way with respect to m. Since x (x 1 m 2 )x 1 + γ = x (x 1 m 2 )x 1 + x 1 (x 1 m 2 ) + α = x x 1 (x 1 m 2 ) + A + 2m 2 x 1 2my 1 = 3x A (3x A) = 0, we see that x 1 is also a solution to the quadratic, and thus a double root of the cubic, so we can factor it out again, yielding x 3 = m 2 x 1 x 2 and y 3 = m(x 1 x 3 ) y 1 so we let P 3 = (x 3, y 3 ) and say P 1 + P 2 = P 3. If P 2 = O then the line through P 1 and O must be vertical, so it intersects E at the reflection of P 1 across the x-axis. Reflecting across the x-axis again yields P 1 + O = P 1. Similarly O + P 2 = P 2, and we extend to O + O = O. The symmetry in our geometric motivation and in these equations themselves makes it clear that this + is commutative, that O serves as an identity element, and that the reflection of a point across the x-axis serves as its additive inverse. We omit the proof here, but it can also be shown that this + is associative, so (E, +) is an abelian group.? 5 Published by DigitalCommons@Liberty University,

7 The Kabod, Vol. 4, Iss. 2 [2018], Art. 1 3 Discrete Logarithms 3.1 The Problem Let G be a multiplicative group. For x G and n Z, we use 1 G if n = 0 x n = x n 1 x if n > 0 (x 1 ) n if n < 0 as our recursive definition of the nth power of g. Observing for n > 0 that { x n (x 2 ) (n 1)/2 x if n is odd = (x 2 ) n/2 if n is even leads us to an efficient algorithm for computing x n. If n < 0 then by definition x n = (x 1 ) n, so let x = x 1 and n = n. If n = 0 then by definition x n = 1 G, so return 1 G. Otherwise, let y = 1 G. Clearly at this point x n = x n y, so if we keep x n y constant while changing our values of x, n, and y then if we reduce n to 1, we will have xy equal to what we originally wanted to compute, so we can just return xy. Thus we will loop while n > 1. If n is even then x n = (x 2 ) n/2, so let x = x 2 and n = n/2 and loop again. If n is odd then x n y = (x 2 ) (n 1)/2 xy, so let y = xy and x = x 2 and n = (n 1)/2 and loop again. After the loop, we have x n = x 1 = x 0 x = x, so return xy. Using a binary representation of n, we can compute n/2 and (n 1)/2 very efficiently using simple bit operations. Each time we do this, we reduce the size of n by at least one bit, so the number of steps in our loop will be less than or equal to the number of bits in n. At each step, we compute x 2 and possibly xy. If we can compute these operations in constant time then the algorithm has the very reasonable time complexity O(log n). For a, b G and k Z, we say that k is a discrete logarithm of a to the base b if b k = a; we write k = log b a. While it is easy to compute a given b and k using the algorithm described above, in general there is no efficient method known to compute k given a and b. Many cryptographic applications are based on the difficulty of this problem. The elliptic curves used in cryptography are used because they are not believed to be susceptible to some less general but more efficient methods for computing discrete logarithms

8 Estep: Elliptic Curves 3.2 Index Calculus The index calculus algorithm can be used to find discrete logarithms in Z q for q prime, in subexponential time as opposed to other algorithms which work in more general groups but take exponential time.? It makes use of the notion of prime numbers, of which there is no analog in elliptic curve groups. Let g Z q be our base. We will assume that g is a primitive root modulo q, which just means that g = Z q. For x Z q and m, n Z with m = log g a and n = log g a, we have g m = g n = a, so m n (mod Z q ). We know Z q = q 1, so log g a can be thought of as a unique element of Z q 1. For x, y Z q, if m = log g x and n = log g y then b m = x, b n = y b m+n = xy m + n = log g xy; in other words, log g x + log g y = log g xy. Thus if we can factor x Z q into a product of things of which we know the discrete logarithms to the base g, then we can sum those to obtain the discrete logarithm of x. We start by choosing a factor base B Z q of elements whose discrete logarithms we will compute first. A typical choice is B = { 1, 2, 3, 5, 7, 11,..., p }{{} r } B = r + 1. the first r primes We know that each element in B has a unique discrete logarithm in Z q 1. Let k Z +. If we can factor then we obtain a linear relation g k mod q = ( 1) e0 2 e1 3 e2 p er r k = e 0 log g ( 1) + e 1 log g 2 + e 2 log g e r log g p r which we can write as a row matrix [ e0 e 1 e 2 e r k] Zq 1 1 (r+2) where k = k mod (q 1). Thus we keep a list of the rows we ve decided to keep so far, and try many k. If we can t factor g k mod q then we move on; otherwise we obtain a new row. We use Gaussian elimination with the rows we have so far to remove as many leading columns in the new row as we can. If the leading coefficient 7 Published by DigitalCommons@Liberty University,

9 The Kabod, Vol. 4, Iss. 2 [2018], Art. 1 e i in this reduced row is a unit in Z q 1 then we multiply by the row by e 1 i, add it to our list of rows, and continue; otherwise we discard it and move on. We continue until we have an (r + 1) (r + 2) matrix in row echelon form, which we can then easily convert to reduced row echelon form to obtain the discrete logarithms for all of B. Now we compute log g h for h Z q. Let s Z +. If we can factor then g s h mod q = ( 1) f0 2 f1 3 f2 p fr r log g h = f 0 log g ( 1) + f 1 log g 2 + f 2 log g f r log g p r s, so once again we try many s in parallel until we find something we can factor, and then we re done. The index calculus tends to be much faster than other methods when it can be applied. However, it depends heavily on the structure of Z q and there is no known adaptation of it that works for arbitrary elliptic curves, which makes the latter attractive for cryptography. 4 Applications 4.1 Cryptography Cryptographic systems are traditionally explained in terms of actors Alice, Bob, and Eve with specific roles. Alice wants to send a message to Bob. Bob wants to know that the message is truly from Alice. Eve wants to read or spoof the message Alice is sending to Bob. The goal of the system is to facilitate Alice s goal and Bob s goal while hindering Eve s goal. If Alice and Bob do not already have a physically secure channel which they can use to communicate with each other, then they must use a public channel and thus must encrypt their communication if they wish it to be private. If they both knew a shared secret key then they could use it in a symmetric encryption scheme such as AES. Diffie-Hellman key exchange allows Alice and Bob to agree on a secret key solely using communication over a public channel, without anyone else knowing what that secret key is.? First Alice and Bob agree on an elliptic curve E over a finite field F such that the discrete logarithm is difficult in E. They also agree on some P E 8 8

10 Estep: Elliptic Curves such that P is large. There are methods to determine the orders of E and P, but we do not discuss them here.? Alice and Bob separately generate random integers a and b, respectively. Alice computes ap and sends it to Bob, and Bob computes bp and sends it to Alice. These are just the ath and bth powers of P expressed in additive notation, which is conventional for elliptic curve groups. Then Alice can compute a(bp ) and Bob can compute b(ap ), which are equal by properties of exponents, so they can use this shared point abp E as their secret key. Note that Eve observes E and P and ap and bp. If Eve can solve the discrete logarithm problem in E then she can compute a or b and thus abp, but the discrete logarithm problem is believed to be difficult over elliptic curves. It is not known if there is a way for an eavesdropper to compute abp without solving the discrete logarithm problem.? This algorithm is actually specifically the elliptic curve Diffie-Hellman key exchange algorithm. The original Diffie-Hellman key exchange algorithm uses Z p for some prime p instead of using an elliptic curve group, making it susceptible to attacks such as the index calculus. Indeed, in 2015 a vulnerability called Logjam was discovered, and the primary recommended defense against this vulnerability is to switch to elliptic-curve Diffie-Hellman.? 4.2 Primality Let n Z +. If n is prime then Z n is a field, allowing us to pick A, B Z n and define an elliptic curve E by y 2 = x 3 + Ax + B. If n is composite then we can still choose A, B Z n and define E = {O} {(x, y) Z n Z n y 2 = x 3 + Ax + B}, but the group law we defined above could fail because there may exist some P 1 = (x 1, y 1 ) E and P 2 = (x 2, y 2 ) E with x 1 x 2 but x 2 x 1 / Z n. However, if our goal is to generate a proof of the primality or compositeness of n, then we can simply insert an extra step into our procedure for adding points on E. We use the extended Euclidean algorithm to find modular inverses, so if any calculation turns up some k Z n with k 0 and gcd(n, k) 1, then the computed gcd(n, k) is a nontrivial factor of n, so we can return it immediately as a proof of compositeness. We will make use of a proposition. Let m Z. If there is a prime q with q m and q > ( 4 n + 1) 2, and there is a point P E such that mp = O, 9 Published by DigitalCommons@Liberty University,

11 The Kabod, Vol. 4, Iss. 2 [2018], Art. 1 and (m/q)p is well-defined and not equal to O, then n is prime. We omit the proof of this proposition; it uses a theorem about E assuming E is a group, and some details regarding computation in E.? The Goldwasser-Kilian algorithm works as follows.? First choose a random P = (x, y) Z n Z n. We can generate a curve that contains this point by choosing a random A Z n and letting B = y 2 x 3 Ax. This defines an elliptic curve E as discussed above. Assuming n is prime, E is a group, so we can apply an algorithm such as Schoof s algorithm to find E.? Again, if this point-counting algorithm fails, it will produce a nontrivial factor of n. If it returns a value m N then we proceed. We try to factor m = kq where k 2 is a small integer and q is a number that we believe to be prime. For instance, if we have applied some fast probabilistic primality test to q which hasn t found it to be composite, then we will guess that it is prime and proceed. If we fail to find such a factorization, we start over with a different random point and curve. Now at this point, we have m and q with q large enough to satisfy the proposition. Then we calculate mp and (m/q)p = kp. Assuming we don t find a nontrivial factor of n in the process, we use these results to determine the primality of n. If mp O then E is not a group, because if it were then we would have m = E by Schoof s algorithm and thus mp = O by Lagrange; thus n is composite. If kp = O then we start over. Otherwise, we have satisfied the conditions of the proposition, so we can return (A, B, m, q, P ) as a certificate that anyone can easily use to verify that n is prime. The only thing remaining is the assumption that q is prime. To determine this, we run the same algorithm recursively using q as the parameter, and include the returned certificate in our certificate. The recursion stops when we reach a prime small enough to verify by other means

12 Estep: Elliptic Curves References [1] Commercial National Security Algorithm Suite and Quantum Computing FAQ U.S. National Security Agency, January [2] Hardy, Godfrey Harold (1940), A Mathematician s Apology, Cambridge University Press, ISBN [3] Agrawal, Manindra; Kayal, Neeraj; Saxena, Nitin (2004). PRIMES is in P. Annals of Mathematics. 160 (2): doi: /annals JSTOR [4] Goldwasser, Shafi, Kilian, Joe, Almost All Primes Can Be Quickly Certified, pdf [5] Lawrence Washington (2003). Elliptic Curves: Number Theory and Cryptography. Chapman & Hall/CRC. ISBN [6] [7] L. Adleman, A subexponential algorithm for the discrete logarithm problem with applications to cryptography, In 20th Annual Symposium on Foundations of Computer Science, 1979 [8] Diffie, W.; Hellman, M. (1976). New directions in cryptography. IEEE Transactions on Information Theory. 22 (6): doi: /tit [9] The Logjam Attack. weakdh.org Published by DigitalCommons@Liberty University,